CVE-2015-7561
First published: Wed Dec 16 2015(Updated: )
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/k8s.io/kubernetes | <1.2.0-alpha.6 | 1.2.0-alpha.6 |
| Kubernetes Dashboard | ||
| Red Hat OpenShift | =3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/kubernetes/kubernetes/pull/18909
- http://kubernetes.io/docs/admin/admission-controllers/#alwayspullimages
- https://docs.openshift.com/container-platform/3.3/architecture/additional_concepts/admission_controllers.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1291963
- https://nvd.nist.gov/vuln/detail/CVE-2015-7561
- https://github.com/kubernetes/kubernetes/commit/e185b1028ac8459f7b451e1115399192e96f6ee9
- https://github.com/advisories/GHSA-2h9c-34v6-3qmr (Advisory)
Frequently Asked Questions
What is the severity of CVE-2015-7561?
CVE-2015-7561 is considered a medium severity vulnerability due to the potential exposure of private images.
How do I fix CVE-2015-7561?
To fix CVE-2015-7561, upgrade Kubernetes to version 1.2.0-alpha.6 or later and ensure proper image access controls are in place.
Who is affected by CVE-2015-7561?
CVE-2015-7561 affects users of Kubernetes in OpenShift 3 who might have access to private images without proper authorization.
What impact does CVE-2015-7561 have on users?
Users who are aware of the names of private images can potentially use them even if they do not have permission to access these images.
Is CVE-2015-7561 present in all Kubernetes installations?
CVE-2015-7561 specifically affects Kubernetes version 1.2.0-alpha.6 and earlier in the context of OpenShift 3.
- collector/github-advisory-latest
- alias/GHSA-2h9c-34v6-3qmr
- alias/CVE-2015-7561
- collector/github-advisory
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/go
- vendor/kubernetes
- canonical/kubernetes dashboard
- vendor/redhat
- canonical/red hat openshift
- version/red hat openshift/3.0